CVE-2025-8018

CVE-2025-8018 Exploit – Food Ordering Review System v1.0 This repository provides a Python proof-of-concept PoC exploit for CVE‑2025‑8018 , a high-severity SQL Injection vulnerability discovered in the Food Ordering Review System v1.0. The vulnerability is triggered via the regId parameter in...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 SQL Injection in Online-Food-Ordering-Web-App The Online-Food-Ordering-Web-App is vulnerable to un-authenticated error and time-based blind SQL Injection attacks. The username parameter on the /login.php page does not sanitize the user input, an attacker is able to...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-11601

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

EUVD-2026-91964

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl...

CVE-2026-75028

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.0.18 . The vulnerability exists within the (template scope) function , specifically related to the 'food_menu_style' Ele...

CVE-2023-2594

CVE-2023-2594 https://vulners.com/cve/CVE-2023-2594 A vulnerability, which was classified as critical, was found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the component Registration. The manipulation of the argument username leads to sql injection. ...

CVE-2026-75028: Improper Control of Filename for Include/Require Statement in PHP Program

The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the template scope function. This makes it possible for authenticated attackers, with contributor-level access and...

PT-2026-104543

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.19 Description The plugin is susceptible to Local File Inclusion, a flaw that allows an attacker to include files from the local server. Authenticated...

PT-2026-104540

Name of the Vulnerable Software and Affected Versions WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System versions prior to 3.0.20 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This...

cve-disclosures

CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE in December 2024. The records were reserved but never published, so nothing is indexed yet. This repo publishes the advisories so the CVEs become searchable and credited. CVE| Product| Type ---|---|--- CVE-2024-57551| Online Food Orderi...

WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Restaurant Menu by MotoPress versions = 2.4.14...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.14 . The flaw stems from insufficient input sanitization and output escaping specifically involving the 'phone_number' parameter. This allows unaut...

EUVD-2026-86597

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-96568: Improper Neutralization of Input During Web Page Generation

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-98401

Name of the Vulnerable Software and Affected Versions Restaurant Menu and Food Ordering versions prior to 2.4.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the...

CVE-2026-92385

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/updatecategory.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit h...